<html>
<head><meta charset="utf-8"><title>Unsafe blocks in unsafe functions · t-compiler/help · Zulip Chat Archive</title></head>
<h2>Stream: <a href="https://rust-lang.github.io/zulip_archive/stream/182449-t-compiler/help/index.html">t-compiler/help</a></h2>
<h3>Topic: <a href="https://rust-lang.github.io/zulip_archive/stream/182449-t-compiler/help/topic/Unsafe.20blocks.20in.20unsafe.20functions.html">Unsafe blocks in unsafe functions</a></h3>

<hr>

<base href="https://rust-lang.zulipchat.com">

<head><link href="https://rust-lang.github.io/zulip_archive/style.css" rel="stylesheet"></head>

<a name="202852682"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/182449-t-compiler/help/topic/Unsafe%20blocks%20in%20unsafe%20functions/near/202852682" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Ram <a href="https://rust-lang.github.io/zulip_archive/stream/182449-t-compiler/help/topic/Unsafe.20blocks.20in.20unsafe.20functions.html#202852682">(Jul 04 2020 at 02:50)</a>:</h4>
<p>There are some instances such as <a href="https://github.com/rust-lang/rust/blob/master/src/libstd/io/mod.rs#L628">here</a> that are unsafe functions that don't contain any unsafe operations. Can these be left untouched or is some sort of comment/explanation required?<br>
Removing the unsafe signature would cause incompatible type issues for files that use these functions.</p>



<a name="202860770"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/182449-t-compiler/help/topic/Unsafe%20blocks%20in%20unsafe%20functions/near/202860770" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> lcnr <a href="https://rust-lang.github.io/zulip_archive/stream/182449-t-compiler/help/topic/Unsafe.20blocks.20in.20unsafe.20functions.html#202860770">(Jul 04 2020 at 07:04)</a>:</h4>
<p>I personally think we don't need an explicit comment here, though it also wouldn't hurt adding<br>
"This is safe and does not rely on any invariants given by the user" as most people are probably still expecting the<br>
internals of an unsafe function to be implicitly unsafe, cc <span class="user-mention" data-user-id="255061">@LeSeulArtichaut</span></p>



<a name="202865659"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/182449-t-compiler/help/topic/Unsafe%20blocks%20in%20unsafe%20functions/near/202865659" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Léo Lanteri Thauvin <a href="https://rust-lang.github.io/zulip_archive/stream/182449-t-compiler/help/topic/Unsafe.20blocks.20in.20unsafe.20functions.html#202865659">(Jul 04 2020 at 09:33)</a>:</h4>
<p>I think that in most of these situations, the caller must provide some guarantees, which aren’t immediately used, but which will be used later. IIRC there are examples of this in <code>Layout::new_unchecked</code> where the function itself doesn’t use the guarantees that the layout is valid, but other pieces of unsafe code rely on them.</p>
<p>I’m not sure safety comments are useful in this kind of situation, and maybe what we could do is to point to these guarantees in the other contexts where we use them.</p>



<a name="202865720"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/182449-t-compiler/help/topic/Unsafe%20blocks%20in%20unsafe%20functions/near/202865720" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Léo Lanteri Thauvin <a href="https://rust-lang.github.io/zulip_archive/stream/182449-t-compiler/help/topic/Unsafe.20blocks.20in.20unsafe.20functions.html#202865720">(Jul 04 2020 at 09:35)</a>:</h4>
<p>Keep in mind though that I’m vert far from an expert so my opinion isn’t that important <span aria-label="slight smile" class="emoji emoji-1f642" role="img" title="slight smile">:slight_smile:</span><br>
If you want good advice you should ask someone from the unsafe code guidelines WG.</p>



<a name="202867911"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/182449-t-compiler/help/topic/Unsafe%20blocks%20in%20unsafe%20functions/near/202867911" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Ram <a href="https://rust-lang.github.io/zulip_archive/stream/182449-t-compiler/help/topic/Unsafe.20blocks.20in.20unsafe.20functions.html#202867911">(Jul 04 2020 at 10:41)</a>:</h4>
<p>Thanks, <span class="user-mention" data-user-id="255061">@LeSeulArtichaut</span> , I'll ask that there too.</p>



<a name="202908909"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/182449-t-compiler/help/topic/Unsafe%20blocks%20in%20unsafe%20functions/near/202908909" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/182449-t-compiler/help/topic/Unsafe.20blocks.20in.20unsafe.20functions.html#202908909">(Jul 05 2020 at 07:00)</a>:</h4>
<p>The important bit for such cases is to document what the caller needs to ensure to safely call this function</p>



<a name="202908923"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/182449-t-compiler/help/topic/Unsafe%20blocks%20in%20unsafe%20functions/near/202908923" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/182449-t-compiler/help/topic/Unsafe.20blocks.20in.20unsafe.20functions.html#202908923">(Jul 05 2020 at 07:01)</a>:</h4>
<p>in case of <code>initializer</code> there is probably little to do as <code>zeroing</code> is actually a safe choice (but the alternative choice of saying that this supports uninit memory would require unsafe)</p>



<a name="202908926"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/182449-t-compiler/help/topic/Unsafe%20blocks%20in%20unsafe%20functions/near/202908926" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/182449-t-compiler/help/topic/Unsafe.20blocks.20in.20unsafe.20functions.html#202908926">(Jul 05 2020 at 07:01)</a>:</h4>
<p>but there are other cases where there actually is something to document even if there is no unsafe op:<br>
<a href="https://www.ralfj.de/blog/2016/01/09/the-scope-of-unsafe.html">https://www.ralfj.de/blog/2016/01/09/the-scope-of-unsafe.html</a></p>



<a name="202908929"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/182449-t-compiler/help/topic/Unsafe%20blocks%20in%20unsafe%20functions/near/202908929" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/182449-t-compiler/help/topic/Unsafe.20blocks.20in.20unsafe.20functions.html#202908929">(Jul 05 2020 at 07:01)</a>:</h4>
<p>there one should document why the data structure invariant of <code>Vec</code> is correctly maintained</p>



<hr><p>Last updated: Aug 07 2021 at 22:04 UTC</p>
</html>